CSRF cookie not set

[VdeJong]

As soon as I try to login using Google SSO on my python/django application I am redirected by Google to the ACS url but it gives me a forbidden 403 error. It says csrf cookie not set.

[pitbulk]

Are you using the @csrf_exempt decorator on the ACS endpoint?

See https://docs.djangoproject.com/en/2.2/ref/csrf/#utilities

[VdeJong]

@pitbulk no I'm not as I thought it is not safe to bypass the csrf. But are you saying that is necessary for this to work?

[pitbulk]

Is safe to bypass csrf on that particular ACS endpoint.
Notice that the POST came from a 3rd party system that is not able to generate a valid CSRF value.
Also notice that the SAML standard has its own mechanism to validate the SAMLResponse generated by the 3rd party (IdP).

[VdeJong]

Alright.
Thanks for your clear explanation and fast reply.